skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-amazon-market-product-search/Gen Agent Trust Hub
ecommerce-amazon-market-product-search
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and displays Amazon marketplace data (such as product titles and descriptions), creating a surface for potential indirect prompt injection attacks where malicious instructions could be embedded in listing content.\n
- Ingestion points: External data enters via the API response handled by
scripts/amazon_market_product_search.py.\n - Boundary markers: The skill documentation recommends using
jqto selectively read saved data, which serves as a boundary to prevent the entire untrusted payload from entering the agent's primary reasoning context.\n - Capability inventory: The skill includes a Python script capable of making network requests via
urlliband writing results to the filesystem.\n - Sanitization: The skill lacks explicit sanitization or filtering of the retrieved marketplace data strings before they are presented to the agent.
Audit Metadata